Multiple memory leaks in Xen 4.0 through 4.6.x allow local guest administrators or domains with certain permission to cause a denial of service (memory consumption) via a large number of "teardowns" of domains with the vcpu pointer array allocated using the (1) XEN_DOMCTL_max_vcpus hypercall or the xenoprofile state vcpu pointer array allocated using the (2) XENOPROF_get_buffer or (3) XENOPROF_set_passive hypercall.
CVSS Details
- CVSS 3.1 Base Score: 5.5
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Alpine Linux | — | Upgrade xen | Sep 20, 2017 | Oct 30, 2015 |
| Debian | — | Upgrade xen | Dec 14, 2015 | Oct 30, 2015 |
| Freebsd | — | Upgrade xen-kernel | Dec 10, 2025 | Nov 11, 2015 |
| Gentoo Linux | — | Upgrade app-emulation/xen-tools.Upgrade app-emulation/xen.Upgrade app-emulation/pvgrub.Upgrade app-emulation/xen-pvgrub. | Oct 30, 2017 | Oct 30, 2015 |
| Suse | — | Upgrade xenUpgrade xen-kmp-traceUpgrade xen-develUpgrade xen-tools-domUUpgrade xen-doc-htmlUpgrade xen-doc-pdfUpgrade xen-toolsUpgrade xen-libs-32bitUpgrade xen-kmp-paeUpgrade xen-tools-xendomains-wait-diskUpgrade xen-libsUpgrade xen-kmp-default | Dec 18, 2015 | Oct 30, 2015 |
| Ubuntu | — | Upgrade xen | Nov 19, 2024 | Oct 30, 2015 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub